feat(agent-harness): authorize bounded web provider requests

[iscekic]

No new behavior — This change prepares web search and page retrieval without changing the features available to users.

---

Summary

executeHarnessWeb adds internal web.search and web.retrieve calls; strict Invocation validation and fresh capability checks bind each call to its authorized request identity.
httpResponseBytes sets an integer limit of 1–1,048,576 bytes before parsing; shared Exa operations retain allowance checks, balance checks, and actual-cost billing.
costMicrodollars uses null for unknown actual costs; callers must commit a durable request reservation before calling this adapter.

Files

• apps/web/src/lib/agent-harness/web-tools.ts — Source; added (A), 135 changed lines (+135/-0). Checks the conversation, operation, definition version, argument digest, dispatch, audience, and backend target before provider access. Validates public Hypertext Transfer Protocol Secure (HTTPS) destinations through existing Domain Name System (DNS) checks. Sends text-enabled search queries and result limits to /search, or normalized page addresses to /contents. Requires JavaScript Object Notation (JSON), bounds streamed bytes before parsing, and preserves the original error if cancellation cleanup fails. Reports revoked access, invalid input, exhausted credit, rejected or malformed responses, overflow, and cancellation. Marks provider statuses 408, 429, and 5xx and transport failures as retryable. Returns provider data unchanged, records actual costs under quick-chat, rejects invalid costs, and leaves missing costs unbilled. Keeps cost at zero before dispatch, and unknown after dispatch when the response is lost or rejected.

Tests: 1 file added — apps/web/src/lib/agent-harness/web-tools.test.ts (Test; A; 264 changed lines, +264/-0). Covers authorized billing, changed or revoked authority, exhausted credit, unsafe destinations, bounded responses, empty data, retryability, cancellation, cleanup failures, and missing/invalid costs.
Generated: 0 changed files.

---

Visual Changes

Visual Changes: N/A

Verification

End-to-end (E2E) verification remains pending at the stack tip; the workflow will run it in bot-e2e mode.
A32 and bot-e2e own live-provider, cross-client, and visual evidence.

Reviewer Notes

Human steps: None before merge or after merge.

• The implementer passed 30 focused tests and five scoped checks using the inspected no-setup Jest configuration.
• The reviewer inspected those results and independently ran the whitespace check; the reviewer did not rerun the tests.
• The tests use doubles for authority, storage, DNS, and transport; they do not verify live-provider behavior or database writes.
• Result normalization, citations, durable reservations, authenticated composition, reservation wiring, and presentation remain outside this change.
• Continuous integration (CI) owns repository-wide type and build validation.
• Repository: Kilo-Org/cloud; worktree: /Users/igor/Projects/.worktrees/shared-agent-harness-3bb0.
• Review range: shared-agent-harness-3bb0-s27...shared-agent-harness-3bb0-s28.

Runtime verification remains pending at the stack tip. This level adds authorized bounded web-provider access without activating a new host.

Stacked PRs — merge bottom to top. Each level shows only its own diff.

Runtime verification (E2E, user advocacy, simplify) runs on the tip PR over every level.
Every level keeps its own checks, its own bot review, and its own threads; each one is answered on its own PR.
Each level is its own deliverable: it builds and passes its own checks alone.
A finding on a level is repaired on that level, then carried upward with stack.sh forward.

1. shared-agent-harness-3bb0 — chore(agent-harness): register workspaces and enforce CI boundaries #5632
2. shared-agent-harness-3bb0-s2 — feat(agent-harness): define portable domain and snapshots #5637
3. shared-agent-harness-3bb0-s3 — feat(agent-harness): define commands tools and permission policy #5639
4. shared-agent-harness-3bb0-s4 — feat(agent-harness): share client state and cursor recovery #5643
5. shared-agent-harness-3bb0-s5 — feat(agent-harness): persist command intents and execution receipts #5647
6. shared-agent-harness-3bb0-s6 — feat(db): add harness ingress grants and retirement fences #5655
7. shared-agent-harness-3bb0-s7 — feat(agent-harness): deliver legacy history and project durable text #5659
8. shared-agent-harness-3bb0-s8 — feat(agent-harness): authorize durable grants and registered clients #5662
9. shared-agent-harness-3bb0-s9 — feat(agent-harness): fence retirement and retry payload cleanup #5667
10. shared-agent-harness-3bb0-s10 — feat(agent-harness): persist authoritative state in SQLite #5675
11. shared-agent-harness-3bb0-s11 — feat(agent-harness): admit durable runs and revisioned commands #5678
12. shared-agent-harness-3bb0-s12 — feat(agent-harness): recover queued runs and stream checkpointed steps #5688
13. shared-agent-harness-3bb0-s13 — feat(agent-harness): resolve interactions and dispatch tools sequentially #5693
14. shared-agent-harness-3bb0-s14 — feat(agent-harness): fence designated client tool execution #5697
15. shared-agent-harness-3bb0-s15 — feat(agent-harness): synchronize durable snapshots and legacy history #5701
16. shared-agent-harness-3bb0-s16 — feat(agent-harness): reuse authorized invitations with durable replay #5704
17. shared-agent-harness-3bb0-s17 — feat(integrations): bound repository transport for harness reads #5710
18. shared-agent-harness-3bb0-s18 — feat(integrations): expose bounded authorized repository reads #5714
19. shared-agent-harness-3bb0-s19 — feat(agent-harness): expose named authorized resource reads #5718
20. shared-agent-harness-3bb0-s20 — feat(sessions): bound history transport for harness reads #5724
21. shared-agent-harness-3bb0-s21 — feat(agent-harness): read scoped Cloud Agent context and progress #5726
22. shared-agent-harness-3bb0-s22 — fix(agent-harness): preserve ordered Cloud Agent dispatch identity #5731
23. shared-agent-harness-3bb0-s23 — feat(agent-harness): hand coding work to authorized Cloud Agent sessions #5733
24. shared-agent-harness-3bb0-s24 — feat(agent-harness): authorize scoped MCP gateway connections #5737
25. shared-agent-harness-3bb0-s25 — feat(agent-harness): bound MCP gateway transport in the Worker #5740
26. shared-agent-harness-3bb0-s26 — feat(agent-harness): execute validated remote MCP tools #5743
27. shared-agent-harness-3bb0-s27 — refactor(exa): share provider dispatch and usage recording #5746
28. shared-agent-harness-3bb0-s28 — feat(agent-harness): authorize bounded web provider requests #5747 ← this PR
29. shared-agent-harness-3bb0-s29 — feat(agent-harness): normalize web sources and preserve citations #5749
30. shared-agent-harness-3bb0-s30 — feat(agent-harness): define closed internal operation contracts #5753
31. shared-agent-harness-3bb0-s31 — feat(agent-harness): authorize internal maintenance operations #5754
32. shared-agent-harness-3bb0-s32 — feat(agent-harness): authorize named Kilo operation dispatch #5755
33. shared-agent-harness-3bb0-s33 — feat(agent-harness): authorize internal provider operations #5757
34. shared-agent-harness-3bb0-s34 — feat(agent-harness): secure the internal operations endpoint #5758
35. shared-agent-harness-3bb0-s35 — feat(agent-harness): bound and sanitize model streams #5767
36. shared-agent-harness-3bb0-s36 — feat(agent-harness): secure billed model inference #5776
37. shared-agent-harness-3bb0-s37 — test(agent-harness): cover model gateway security boundaries #5777 (tip)

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• apps/web/src/lib/agent-harness/web-tools.ts
• apps/web/src/lib/agent-harness/web-tools.test.ts

---

_{Reviewed by grok-4.6 · Input: 266.5K · Output: 24.6K · Cached: 967.6K}

_{Review guidance: REVIEW.md from base branch shared-agent-harness-3bb0-s27}

[iscekic]

Closing: the owner stopped this workflow section. The branch is retained.